PT-2026-4615 · WordPress · Wp Directory Kit

Sarawut Poolkhet · Published 2026-01-24 · Updated 2026-03-17 · CVE-2025-13920

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.4.9

Description The WP Directory Kit plugin for WordPress has a flaw that allows unauthenticated attackers to obtain email addresses of users with specific Directory Kit user roles. This is possible through the wdk public action AJAX handler.

Recommendations Update WP Directory Kit to a version later than 1.4.9.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-13920

Affected Products

Wp Directory Kit

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13920 · Security Note
• https://twitter.com/pdnuclei_bot/status/2033785434153824460 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/8905dcc7-d3c8-4ae8-818c-df3e6ed2ad9c?source=cve · Note
• https://t.me/cveNotify/149792 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3435482/wpdirectorykit · Note
• https://twitter.com/VulmonFeeds/status/2015098625357975804 · Twitter Post
• https://t.me/CVEtracker/42947 · Telegram Post
• https://twitter.com/CVEnew/status/2015086208875950098 · Twitter Post